Least privilege

Giving the assistant only the abilities it needs. It can only write text, so an injected instruction cannot refund or email anyone.